rlm_pap: show the request password on mismatch, not the "known good" one